Digital Forensic Examiners Research Articles

X-Ways Forensics Platform For Digital Forensics Examiners

Digital Forensics & Cyber Security Graduate Programme Department Of Information Systems & Innovations Ghana Institute of Management & Public Administration Greenhill, Accra, Ghana E-mails: sethadjeigyimah@gmail.com/ seth-adjei.gyimah@st.gimpa.edu.gh Phone: +233244475540 ABSTRACT Crime has evolved over the years from its traditional form to digital crimes. Those who commit such crimes use advanced and sophisticated tools, equipment and techniques to perpetuate such crimes. In order to effectively and efficiently investigate, examine and gather evidence from such complex crimes, digital examiners have to employ various tools and techniques to analyze, extract and recover data as evidence to assist in prosecution of the perpetrators of the crime. This paper analyzes X-Ways Forensics platform which is an application software for forensic examiners as a forensic tool for data extraction, analysis and recovery. Dr. Larry Leibrock, Founder and CTO of eForensics revealed his admiration for X-Ways Forensics application when he said “As a professional forensics examiner, I have used X-Ways Forensics as a forensics instrument in recovering and analyzing digital information. I have tested and validated the professional version and it has proved to be accurate and trustworthy in its reporting. I have the highest level of confidence in X-Ways Forensics efficacy in digital forensics cases. I am confident that the tool and my use of this instrument would stand legal review and opposing challenge.” Keywords: X_ways, Cybersecurity, Forensics, Detection, Cyber space, Examiners BOOK Chapter ǀ Research Nexus in IT, Law, Cyber Security & Forensics. Open Access. Distributed Free Citation: Seth Adjei Gyimah (2022): X-Ways Forensics Platform For Digital Forensics Examiners Book Chapter Series on Research Nexus in IT, Law, Cyber Security & Forensics. Pp 353-356 www.isteams.net/ITlawbookchapter2022. dx.doi.org/10.22624/AIMS/CRP-BK3-P56

Exploring Lack of Due Diligence as a Threat to Forensic Analysis Preparation and Readiness

The usage of digital technology in the digital forensic investigation has grown in tandem with the rising importance of technology today. Too many incidences of digital and physical crime which is the focus of the world nowadays. To gather the finest evidence and investigative outcomes, a digital forensic model must be established. This study included a review of the literature on digital forensics and models established in digital forensics. According to the findings, the majority of research involves broad inquiries and procedures that overlap. Furthermore, no model has been developed to design a systemic inquiry. In this study, we propose a methodology for digital forensic examination to address this issue. This model combines several of the previous models and adds some new variables that are relevant to the study. Keywords: Due Diligence, Threats, Forensic Analysis, Preparation, Readiness, Cyber Security, BOOK Chapter ǀ Research Nexus in IT, Law, Cyber Security & Forensics. Open Access. Distributed Free Citation: Jonas Takyi Asamoah (2022): Exploring Lack of Due Diligence as a Threat to Forensic Analysis Preparation and Readiness Book Chapter Series on Research Nexus in IT, Law, Cyber Security & Forensics. Pp 307-314 www.isteams.net/ITlawbookchapter2022. dx.doi.org/10.22624/AIMS/CRP-BK3-P49

Forming an investigative opinion in digital forensics

AbstractAs we now see digital evidence play a role in many investigative scenarios, it is imperative that those seeking to rely upon it as part of criminal justice processes can do so, absent any concern regarding its validity. Interpreting the meaning of digital data and its potential value to a criminal inquiry as part of a digital forensic examination is a complex and multifaceted process requiring the practitioner to possess the relevant knowledge, experience, and insight needed to determine the case‐significance of a given data trace accurately. Erroneously interpreted data that is communicated to a client and subsequently relied upon can have far‐reaching consequences for all those involved in the investigative process. This work discusses the process of forming investigative opinions in digital forensic science examinations, what this means in practice, and the ways in which it can be achieved. Focus will be given to the process of forming an investigative opinion when underpinned through the reconstruction and testing of a suspect system/setup, with a formal three‐stage methodology for doing this outlined.This article is categorized under: Digital and Multimedia Science > Cybercrime Investigation

Considering ‘technically possible’ alternative meanings for data traces found during a digital forensic examination

ABSTRACT As part of a digital forensic examination, a practitioner may identify data traces that they believe to be relevant to their inquiry and seek to interpret their meaning, forming a primary investigative hypothesis. In addition, practitioners should also consider whether any traces could mean something else. This work discusses the need for practitioners to consider ‘technically possible’ alternative meanings (TPAMs) as a standard component of their interpretive process. It is proposed that, when considering whether any TPAMs exist in addition to the practitioner’s primary investigative hypothesis regarding a data trace, the practitioner’s position may be expressed in one of six ways – ‘the six categories of TPAM’, based upon the available objective support related to or present within their case, from which the TPAM is derived. These six categories are proposed in order to help a practitioner effectively communicate their reasoning for offering a TPAM in regards to any data trace found during an investigation and are defined and discussed.

Analysis of sysdiagnose in iOS 15 to identify the sending phone number of AirDrop data.

Modern cell phones allow for easy communication and transfer of data between devices. Unfortunately, some of the data transferred can be of unwelcomed, illicit, or threatening imagery and other files; digital forensic examiners are often asked to identify the source of these files. In this project, we developed a method to gain insights into the device used to send a file via Apple AirDrop. Our method brute forces the partial SHA256 hash entries found in the receiving Apple device's sysdiagnose logs to reveal the sender's phone number, even if that phone number was not known by the receiving device. This research publishes a method to generate permutations of the partial hash values using potential US area codes to identify the complete phone number of the sending device. In this research project, exemplar photographs were transmitted via AirDrop between Apple devices running iOS 15. A sysdiagnose was then generated on the receiving phone and exported by AirDrop to a MacBook Air for analysis. The analysis of the generated sysdiagnose archive found a partial SHA-256 hash of the sending device's phone number. This research identified a method to generate permutations of the partial SHA-256 hashes using a possible country and area code for the sending device in order to successfully identify the sending device's phone number. As a result, it was found that the sender of an unknown AirDrop file's phone number can be identified from the receiving device's sysdiagnose log files.

Defining principles for preserving privacy in digital forensic examinations

As digital devices play an increasing role in criminal investigations, where in some cases the data they contain may describe events where few other sources of information exist, there is an increasing concern regarding potential privacy invasion caused by their examination. ICO, 2020, the Information Commissioner's Office called for the greater evaluation and scrutiny of data extraction and examination processes deployed by investigating authorities with regard to smartphone data. In doing so, a light was shone on the wider issues and balancing act of maintaining data privacy whilst still allowing for an effective investigation to be conducted by law enforcement. This article proposes a set of ten Privacy-Preserving Data Processing Principles (PPDPP) for consideration by those conducting the digital forensic extraction and examination of data from a digital device. These principles define conduct that is indicative of privacy-preserving, where it is encouraged that those undertaking device investigations demonstrate evidence of adherence to the spirit of them.

Conducting a ‘manual examination’ of a device as part of a digital investigation

As those tasked with investigating incidents regularly encounter the need to examine content on associated digital devices, there is a need to ensure this task is carried out both effectively and efficiently. In addition to the traditional digital forensic examination workflow, in some cases first responders/investigators have the option to ‘manually examine’ a device live, in order to quickly identify and evaluate any valuable content it may contain. This process may have particular benefits when dealing with inquiries at scene. In this paper, the concept of a device ‘manual examination’ is discussed, including what it is and how it can be applied. A ‘device manual examination procedure’ is proposed - a framework for supporting the first responder/investigator in determining when a device manual examination is a viable device interrogation option as part of their inquiries, and to ensure they are effectively prepared to conduct it. This work is intended to support operational first responders/investigators to conduct device manual examinations appropriately.

Strategies for safeguarding examiner objectivity and evidence reliability during digital forensic investigations

The paper investigates how digital forensic (DF) practitioners approach examiner objectivity and evidence reliability during DF investigations. Fifty-three DF practitioners responded to a questionnaire concerning these issues after first receiving a scenario, contextual information, and a task description and then examining an evidence file. The survey showed that hypotheses played an important role in how the DF practitioners handled contextual information before the analysis and safeguarding objectivity during the analysis. Dual tool verification was the most frequently referred measure for controlling evidence reliability. The analysis of responses revealed three significant causes of concern. First, 45% started the analysis without an innocence hypothesis in mind. Second, 34% applied no techniques to maintain their objectivity during the analysis. Third, 38% did not use any techniques to examine or control evidence reliability. The paper provides insights into how DF investigations are carried out in practice. These insights are essential for the DF community to guide the development of procedures that safeguard fair investigations and effective error mitigation strategies.

Digital investigations: relevance and confidence in disclosure

The field of digital forensics has grown exponentially to include a variety of digital devices on which digitally stored information can be processed and used for different types of crimes. As a result, as this growth continues, new challenges for those conducting digital forensic examinations emerge. Digital forensics has become mainstream and grown in importance in situations where digital devices used in the commission of a crime need examining. This article reviews existing literature and highlights the challenges while exploring the lifecycle of a mobile phone examination and how the disclosure and admissibility of digital evidence develops.

SpeechToText: An open-source software for automatic detection and transcription of voice recordings in digital forensics

Voice is the most natural way for humans to communicate with each other, and more recently, to interact with voice controlled digital machines. Although text is predominant in digital platforms, voice and video are becoming increasingly important, with communication applications supporting voice messages and videos. This is relevant for digital forensic examinations, as content held in voice format can hold relevant evidence for the investigation. In this paper, we present the open source SpeechToText software, which resorts to state-of-the art Voice Activity Detection (VAD) and Automatic Speech Recognition (ASR) modules to detect voice content, and then to transcribe it to text. This allows integrating voice content into the regular flow of a digital forensic investigation, with transcribed audio indexed by text search engines. Although SpeechToText can be run independently, it also provides a Jython-based software module for the well-known Autopsy software. The paper also analyzes the availability, storage location and audio format of voice-recorded content in 14 popular Android applications featuring voice recordings. SpeechToText achieves 100% accuracy for detecting voice in unencrypted audio/video files, a word error rate (WER) of 27.2% when transcribing English voice messages by non-native speakers and a WER of 7.80% for the test-clean set of LibriSpeech. It achieves a real time factor of 0.15 for the detection and transcription process in a medium-range laptop, meaning that 1 min of speech is processed in roughly 9 s.

The different types of reports produced in digital forensic investigations

The importance of ensuring the results of any digital forensic (DF) examination are effectively communicated cannot be understated. In most cases, this communication will be done via written report, yet despite this there is arguably limited best practice guidance available which is specific for this field in regards to report construction. Poor reporting practices in DF are likely to undermine the reliability of evidence provided across this field, where there is a need for formalised guidance regarding the requirements for effective DF report construction; this should not be a task left solely to each individual practitioner to determine without instruction. For this, the field of DF should look to the wider forensic community and the existing work in this area for support. In line with many other ‘traditional’ forensic science types, a DF practitioner can be commissioned to report in one of three ways - ‘technical’, ‘investigative’ or ‘evaluative’, where each reporting type maintains a specific purpose and interpretative-context, determined by the examination workflow undertaken by a practitioner following client instruction. This work draws upon guidance set out in fundamental forensic science reporting literature in order to describe each reporting type in turn, outlining their scope, content and construction requirements in an attempt to provide support for the DF field.

FADE: A forensic image generator for android device education

AbstractRealistic case studies are essential to training successful digital forensics examiners. However, the generation of realistic datasets is time‐consuming and resource taxing. This paper presents a technical solution that populates Android emulators with realistic mobile forensic data. The emulator's data can be extracted into a raw disk image that is usable in mobile forensic training scenarios. In addition, the tool allows a user to populate the Android emulators with custom text messages, phone contacts, phone calls, and files. This population task is achieved by utilizing the Android Debug Bridge, Android Content Providers, SQLite databases, and the NodeJS runtime environment. This paper presents the software design and development, the requirements and limitations, and the testing process implemented in this research. The contribution of this paper is twofold. First, it identifies potential data and mechanisms to generate Android mobile forensic datasets using customized data population. Second, it creates a foundation for future research on the topic of mobile forensic emulators for training purposes.This article is categorized under: Digital and Multimedia Science > Mobile Forensics Crime Scene Investigation > Education and Formation

Dirty Work? Policing Online Indecency in Digital Forensics

Abstract More than 80 per cent of the work undertaken by digital forensics examiners deals with images of sexual abuse of children. While a growing body of literature analyses the emotional dimensions of coping with such material and the need to minimize exposure to it, less attention has been given to the day-to-day organizational arrangements in which such images are processed. Using ethnographic observations and interviews with practitioners, police officers and senior managers in four constabularies in England, this article examines the tension-ridden place for managing extensive contact with indecent images of children and argues that despite handling of transgressive material, digital forensic examiners distance themselves from imputations of being ‘dirty’ workers.

Solid state drive forensics analysis—Challenges and recommendations

AbstractSolid state drive (SSD) is rapidly replacing hard disk drive (HDD) in almost all computing devices. With the exponential growth in SSD technologies, it is quite possible that very soon HDD will become obsolete. It is good news for the end‐users, but may not be so pleasant for the digital forensics examiners. It has been a challenge for the cyber‐crime investigator ever since the evolution of SSD technology. The intrinsic characteristics of SSD are not very supportive for forensic examiners. The TRIM function and background garbage process make it difficult to retrieve deleted artifacts from the SSD. The traditional disk write blocker cannot stop the background process. There is a lot of uncertainty involved in SSD data acquisition. Sometimes it is also difficult to prove the integrity of SSD in the court of law which makes the SSD's legal admissibility questionable. The objective of this article is to examine the uncertainty involved in SSD forensics with experimental analysis. This article discusses in detail the different components of SSD and its working principle followed by experimental forensics analysis, critical observations, guidelines, and recommendations.

Microsoft's Your Phone environment from a digital forensic perspective

Your Phone is a Microsoft dual mobile/desktop application that links a Windows 10 environment to a smartphone. The Android version provides the smartphone's user with the ability to control the mobile device from Windows 10, allowing to place/receive calls, send/receive text messages such as SMS, MMS and RCS, access up to the last 2000 photos/screenshots of the device and to receive notifications from applications, all through the Windows 10 Your Phone application and, if configured to do so, within Windows 10 notification center.This work analyzes the Your Phone environment, that is, Your Phone Companion for Android and Your Phone for Windows 10. The paper studies the digital forensic artifacts that can be found in a post mortem analysis, focusing on the SQLite3 databases used by both the Android and Windows 10 applications. We also compare the examined version with a previous version of Your Phone, showing that Your Phone newest functionalities bring new valuable artifacts for forensic examiners.The study shows that Your Phone data left on a Windows 10 device can be useful to access a copy of messages, photos, and document interactions, especially when the Android device is inaccessible or even physically unavailable. To ease the task for digital forensic examiners, we have updated our open-source YPA software that collects and analyzes Your Phone data from a Windows 10 system. YPA runs as a module within the digital forensic Autopsy software.

A hierarchy of expert performance (HEP) applied to digital forensics: Reliability and biasability in digital forensics decision making

In order to examine the biasability (impact of contextual information) and reliability (consistency) of digital forensic observations, interpretations, and conclusions, 53 digital forensics (DF) examiners analysed the same evidence file. For biasability, some DF examiners were provided with contextual information suggesting guilt or innocence, while a control group received no contextual information. As per biasability, the results showed that the DF examiners' observations were affected by the biasing contextual information. As per reliability, the results showed low reliability between DF examiners in observations, interpretations, and conclusions. For improving DF work, as well as for transparency, it is important to study and assess the biasability and reliability of their decision making.

Contemporaneous notes for digital forensic examinations

Given the complexity of many examination-scenarios, practitioners in the field of digital forensics should consider the production and maintenance of contemporaneous notes a core part of any examination process. Not only do contemporaneous notes support the practitioner as they conduct their case work, through to the production of any accompanying report, but in some instances disclosure of this information may be required in order for all parties to evaluate any evidential findings fully. This work discusses the need for, and role of, contemporaneous notes in digital forensics, where a ‘skeleton’ of content outlining the required information practitioners should look to include in their contemporaneous notes is offered.

Standardizing digital forensic examination procedures: A look at Windows 10 in cases involving images depicting child sexual abuse

AbstractAs a topic area, the need for the standardization of operational practices in digital forensics has seen much discussion. There are clear benefits for digital forensics if its procedures can be harmonized including increasing the reliability of the work produced by its practitioners, consistency of practice, and the potential for greater quality control, however, attaining standardization is a difficult task, and further work in this field is required. This work discusses the “standardization challenge” assessing both the need for standardization and the feasibility of achieving it. It is suggested that those actively contributing in this area should consider the development of models for defining operational practice which are offence‐specific, device‐specific and operating system‐specific. To support this proposal, an example standard is offered and discussed which suggests and documents the minimum expected requirements for the examination of Windows 10 devices in cases involving images depicting child sexual abuse.This article is categorized under: Digital and Multimedia Science > Cybercrime Investigation

Digital evidence experts in the law enforcement community: understanding the use of forensics examiners by police agencies

Mobile phones are often used in criminal enterprises as well as by individual offenders. In criminal cases, almost 80–90% of the cases criminal computer forensic examiners work on are related to child pornography (Nodeland et al. J Crim Justice Educ 30:71–90, 2018). In an effort to fight electronic crime and to collect digital evidence for criminal acts, law enforcement agencies are incorporating the collection of tools for analysis of digital evidence, also known as computer forensics, into their law enforcement infrastructure. Police agencies are challenged with the need to train officers to collect digital evidence and keep up with large and evolving technologies such as computer operating systems and cell phone technologies. Digital evidence is now being used to prosecute all types of crimes. Skilled officers and examiners are needed to examine this critical need in the criminal justice system. This research surveyed 59 (N = 59) Texas police agencies in their use of digital forensic examiners. The findings reflect that numerous agencies often use a part-time police officer/examiner to investigate the digital evidence that comes into the agency that can limit the expertise in the agency. Implications for this research are discussed.

Digital Forensics in private Seafile Cloud Storage from both client and server side

Nowadays, some people and organisations are unwilling to store their information on public clouds due to security and privacy problems. With increased use of established cloud services by cloud software, it is possible for malicious users to use these services for criminal purposes, so digital forensic investigations of these cloud services are necessary. Seafile cloud storage is one of popular cloud that is free and open source. In this paper, we document a series of digital forensic experiments on Seafile cloud storage service with the aim of providing forensic researchers and practitioners on both the client and server sides of Seafile. Data remnants are checked on client systems in virtual machines which running Windows 10 Home operating system and on a server with Windows Server 2012 R2 operating system. Different circumstances are created for digital forensic examinations. Correspondingly, Seafile client software and multiple browsers are used for interaction with Seafile cloud server.